This morning, I went to my Lloyds ATM. Imagine my surprise when, instead of the usual user interface on the screen, I saw the Windows XP Professional "flying window" logo. Surely they can't be using such a bug-ridden and vulnerable operating program to safeguard their (and my) money?John SteensonMicrosoft Windows XP (or Windows XP Embedded) has become the dominant operating system for ATMs and point-of-sale [EPoS] tills over the past decade, often replacing IBM's OS/2. Some use Windows CE, Unix and various real-time operating systems.

Since I haven't noticed any major problems being reported, XP appears to be secure enough. Either Windows 7 or Linux should be more secure, but that would only matter if one of XP's insecurities turned out to be exploitable.

Windows XP became popular for a number of reasons. It's easy for companies to program for its graphical user interface, and to connect to a range of peripherals, including magnetic stripe readers, cameras, fingerprint readers and printers. This has resulted in cash machines that do a lot more than dispense cash. The Windows Extensions for Financial Services (XFS) have been adopted as a standard, now known as CEN/XFS.

In any case, ATM security involves a great many risks besides the operating system software, and includes breaking open or stealing the whole machine. Common attempts at fraud may also include stealing, cloning or creating cards, "shoulder surfing" to collect PINs, "social engineering" (eg phone calls to the user or the bank's call centre), hacking, and the use of "skimmers". A post by Brian Krebs has some fascinating pictures of skimmers from Rick Doten, chief scientist at Lockheed Martin's Center for Cyber Security Innovation. Krebs says:

According to Doten, the US Secret Service estimates that annual losses from ATM fraud totaled about $1 billion in 2008, or about $350,000 each day. Card skimming, where the fraudster affixes a bogus card reader on top of the real reader, accounts for more than 80% of ATM fraud, Doten said.

A recent report from Javelin Strategy & Research says that "in addition to the use of skimming devices, thieves are now gaining access to customers PINs by manipulating ATM software and by sending out bogus text messages to consumers requesting their personal information".

For example, there have been ATM attacks in which apparent maintenance crews opened up ATMs and installed malware on the machines, he said. Early last year, Diebold Inc issued a security update for its Windows-based ATMs after criminals attacked a number of them in Russia and installed malware designed to steal sensitive data. In other cases, such as in the RBS WorldPay heist, criminals target the backend, where the ATM interfaces with other networks at a financial institution, Vamosi said.

Still, securing an ATM is like securing your house: you're not going to make it 100% secure, and your spending on security (CCTV, burglar alarms, bars on windows, floodlights, guard dogs, a moat…) will reflect your perception of risk. Banks are only likely to spend money to increase ATM security in response to growing losses from fraud. The implication is that Windows XP's insecurities are not costing them a lot of money at the moment.

That could, of course, change, and it wouldn't be the first time the banks' assumptions had turned out to be wrong.